SB2026072202 - Multiple vulnerabilities in Next.js

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072202

SB2026072202 - Multiple vulnerabilities in Next.js

Published: July 22, 2026

Security Bulletin ID SB2026072202
CSH Severity
High
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-64645)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to improper neutralization of user-controlled input in rewrites() and redirects() destination hostname handling when constructing an external destination hostname from request-controlled input. A remote attacker can send a specially crafted request to perform server-side request forgery.

For rewrite rules, the application proxies the request to the attacker-selected host and serves the response from the application's origin.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-64646)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in Server Actions using the Edge runtime when handling requests targeting App Router applications. A remote attacker can send a large request payload to cause a denial of service.

Only Next.js applications using App Router with at least one Server Action that uses the Edge runtime are vulnerable.


3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-64649)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to cause the server to send outbound requests to a malicious host and disclose sensitive information.

The vulnerability exists due to improper input validation in Server Actions when forwarding or redirecting requests using Host-associated headers controlled by the request. A remote attacker can supply crafted Host-associated headers to cause the server to send outbound requests to a malicious host and disclose sensitive information.

Applications are affected when the incoming host header is not fixed to a trusted value.


4) Use of cache containing sensitive information (CVE-ID: CVE-2026-64648)

CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper cache key generation in the server-side fetch cache when processing fetch requests with a request body and a different init than the one used to create the Request object. A remote attacker can send a specially crafted request to disclose sensitive information.

User interaction is required, and only server-side fetch calls using a Request object together with a different init are affected. Applications using Pages Router are not vulnerable.


5) Improper Authorization (CVE-ID: CVE-2026-64642)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to bypass middleware or proxy-based authentication and gain unauthorized access to protected application content.

The vulnerability exists due to improper authorization in App Router applications when processing crafted requests in builds using Turbopack with a single entry in config.i18n.locales. A remote attacker can send a specially crafted request to bypass middleware or proxy-based authentication and gain unauthorized access to protected application content.

Only App Router applications built with Turbopack and configured with a single locale are vulnerable.


6) Excessive Iteration (CVE-ID: CVE-2026-64641)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to excessive iteration in App Router server actions handling when processing crafted requests. A remote attacker can send crafted requests to cause a denial of service.

Only applications using App Router with at least one Server Action are vulnerable.


7) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-64647)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper encoding or escaping of output in the server-side fetch response cache when processing requests with bodies containing invalid UTF-8 byte sequences. A remote attacker can send specially crafted requests to disclose sensitive information.

Only requests using a content type charset other than UTF-8 are affected, and the issue can cause a cached response body from one request to be returned for a different request to the same URL with a different body.


8) Resource exhaustion (CVE-ID: CVE-2026-64644)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the Image Optimization API endpoint when processing remotely hosted malicious SVG images through the /_next/image endpoint. A remote attacker can supply a specially crafted SVG image to cause a denial of service.

Only self-hosted deployments using the default image loader with remote image optimization configured are vulnerable. Only configured remotePatterns are affected, and exploitation can lead to CPU exhaustion.


9) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-64643)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose internal Server Function endpoints.

The vulnerability exists due to insertion of sensitive information into sent data in publicly served client artifacts when exposing Server Action references. A remote attacker can access client artifacts containing action references to disclose internal Server Function endpoints.

This affects applications using App Router with Server Actions or use cache, and the disclosure is typically a recon or enumeration primitive.


Remediation

Install update from vendor's website.

References